Asda Soft
Monthly
Stack-based buffer overflow in Delta Electronics ASDA-Soft allows local attackers with no privileges to execute arbitrary code by tricking users into opening a malicious file. The vulnerability achieves complete system compromise (confidentiality, integrity, availability all rated High in CVSS) through user interaction with crafted input. No public exploit identified at time of analysis, though the low attack complexity and lack of required privileges increase realistic exploitation risk once details emerge.
ASDA-Soft Stack-based Buffer Overflow Vulnerability [CVSS 7.8 HIGH]
A stack-based buffer overflow in Delta Electronics ASDA-Soft, the configuration utility for ASDA series servo drives, allows memory corruption when a local user opens a crafted project or configuration file. Affected are ASDA-Soft installations on engineering workstations (the CPE wildcard cpe:2.3:a:deltaww:asda_soft:*:*:*:*:*:*:*:* indicates all versions are in scope); exploitation requires the victim to actively open an attacker-supplied file and yields code execution in the context of the current user, with high confidentiality, integrity, and availability impact (CVSS 7.8, AV:L/AC:L/PR:N/UI:R/S:U). No public exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS is low at 0.20% (9th percentile), though the reliance on file-delivery social engineering to operator workstations keeps the residual risk non-trivial in industrial environments.
Stack-based buffer overflow in Delta Electronics' ASDA-Soft servo commissioning software can be triggered when a user opens a maliciously crafted project or configuration file, allowing arbitrary code execution, data corruption, or a crash at the privilege level of the user running the application. Because exploitation requires local access and the victim to actively open an untrusted file (AV:L, UI:R, PR:N, CVSS 7.8), it is not remotely exploitable and depends on social engineering rather than a network-reachable service. There is no public exploit identified at time of analysis and no CISA KEV listing; EPSS is 0.20% (9th percentile), indicating low predicted real-world exploitation, though the small and typically isolated OT/engineering installation base also limits mass-scanning activity.
ASDA-Soft: Version 5.4.1.0 and prior does not properly sanitize input while processing a specific project file, allowing a possible out-of-bounds write condition. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
ASDA-Soft: Version 5.4.1.0 and prior does not properly sanitize input while processing a specific project file, allowing a possible out-of-bounds read condition. Rated high severity (CVSS 7.1), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Stack-based buffer overflow in Delta Electronics ASDA-Soft allows local attackers with no privileges to execute arbitrary code by tricking users into opening a malicious file. The vulnerability achieves complete system compromise (confidentiality, integrity, availability all rated High in CVSS) through user interaction with crafted input. No public exploit identified at time of analysis, though the low attack complexity and lack of required privileges increase realistic exploitation risk once details emerge.
ASDA-Soft Stack-based Buffer Overflow Vulnerability [CVSS 7.8 HIGH]
A stack-based buffer overflow in Delta Electronics ASDA-Soft, the configuration utility for ASDA series servo drives, allows memory corruption when a local user opens a crafted project or configuration file. Affected are ASDA-Soft installations on engineering workstations (the CPE wildcard cpe:2.3:a:deltaww:asda_soft:*:*:*:*:*:*:*:* indicates all versions are in scope); exploitation requires the victim to actively open an attacker-supplied file and yields code execution in the context of the current user, with high confidentiality, integrity, and availability impact (CVSS 7.8, AV:L/AC:L/PR:N/UI:R/S:U). No public exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS is low at 0.20% (9th percentile), though the reliance on file-delivery social engineering to operator workstations keeps the residual risk non-trivial in industrial environments.
Stack-based buffer overflow in Delta Electronics' ASDA-Soft servo commissioning software can be triggered when a user opens a maliciously crafted project or configuration file, allowing arbitrary code execution, data corruption, or a crash at the privilege level of the user running the application. Because exploitation requires local access and the victim to actively open an untrusted file (AV:L, UI:R, PR:N, CVSS 7.8), it is not remotely exploitable and depends on social engineering rather than a network-reachable service. There is no public exploit identified at time of analysis and no CISA KEV listing; EPSS is 0.20% (9th percentile), indicating low predicted real-world exploitation, though the small and typically isolated OT/engineering installation base also limits mass-scanning activity.
ASDA-Soft: Version 5.4.1.0 and prior does not properly sanitize input while processing a specific project file, allowing a possible out-of-bounds write condition. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
ASDA-Soft: Version 5.4.1.0 and prior does not properly sanitize input while processing a specific project file, allowing a possible out-of-bounds read condition. Rated high severity (CVSS 7.1), this vulnerability is no authentication required, low attack complexity. No vendor patch available.